Hash Generator (MD5, SHA-1, SHA-256, SHA-512)

Frequently asked questions

Why offer MD5 at all if it's broken?

MD5 is exposed here for legacy checksum and interop use only — verifying a file against a vendor-published MD5, matching an old system's hash column — never for security. It's cryptographically broken for anything security-sensitive (password hashing, signatures); use SHA-256 or SHA-512 for that.

Which hash should I use for password storage?

None of these, directly. Plain SHA-256/SHA-512 are fast general-purpose hashes, not designed for passwords — a real password hash needs a slow, salted algorithm like bcrypt, scrypt, or Argon2. See the guide below for the full comparison.

Why is MD5 computed differently from the others?

The browser's native Web Crypto API (crypto.subtle.digest) deliberately excludes MD5 since it's cryptographically broken — there's no built-in browser primitive to call. MD5 here is a hand-rolled implementation of RFC 1321; SHA-1/256/512 use the native, browser-optimized implementation.

Is my text uploaded anywhere?

No. Hashing happens locally in your browser tab — nothing is sent to a server.